HB 1161 2003
1	CHAMBER ACTION
2
3
4
5
6	The Committee on Public Safety & Crime Prevention recommends the
7	following:
8
9	Committee Substitute
10	Remove the entire bill and insert:
11	A bill to be entitled
12	An act relating to identity theft and Internet fraud
13	prevention, investigation, and prosecution; amending s.
14	817.568, F.S.; expanding the definition of personal
15	identification information; revising the elements of the
16	offense of criminal use of personal identification
17	information in which such use results in an unlawful
18	benefit, injury, or fraud; providing for mandatory minimum
19	terms of imprisonment for certain acts of criminal use of
20	personal identification information; amending s. 934.23,
21	F.S.; providing a definition; clarifying that Florida
22	judges with jurisdiction over specific crimes have
23	authority to issue search warrants for electronic evidence
24	relating thereto, regardless of where the electronic
25	evidence is situated; creating s. 92.605, F.S.; providing
26	definitions; providing for self-authentication for out-of-
27	state business records under certain circumstances with
28	notice to opponent; providing for procedures; amending s.
29	921.0022, F.S., relating to the offense severity ranking
30	chart of the Criminal Punishment Code; conforming
31	provisions to changes made by the act; providing an
32	effective date.
33
34	Be It Enacted by the Legislature of the State of Florida:
35
36	Section 1. Section 817.568, Florida Statutes, is amended
37	to read:
38	817.568 Criminal use of personal identification
39	information.--
40	(1) As used in this section, the term:
41	(a) "Access device" means any card, plate, code, account
42	number, electronic serial number, mobile identification number,
43	personal identification number, or other telecommunications
44	service, equipment, or instrument identifier, or other means of
45	account access that can be used, alone or in conjunction with
46	another access device, to obtain money, goods, services, or any
47	other thing of value, or that can be used to initiate a transfer
48	of funds, other than a transfer originated solely by paper
49	instrument.
50	(b) "Authorization" means empowerment, permission, or
51	competence to act.
52	(c) "Harass" means to engage in conduct directed at a
53	specific person that is intended to cause substantial emotional
54	distress to such person and serves no legitimate purpose.
55	"Harass" does not mean to use personal identification
56	information for accepted commercial purposes. The term does not
57	include constitutionally protected conduct such as organized
58	protests or the use of personal identification information for
59	accepted commercial purposes.
60	(d) "Individual" means a single human being and does not
61	mean a firm, association of individuals, corporation,
62	partnership, joint venture, sole proprietorship, or any other
63	entity.
64	(e) "Person" means a "person" as defined in s. 1.01(3).
65	(f) "Personal identification information" means any name
66	or number that may be used, alone or in conjunction with any
67	other information, to identify a specific individual, including
68	any:
69	1. Name, social security number, date of birth, official
70	state-issued or United States-issued driver's license or
71	identification number, alien registration number, government
72	passport number, employer or taxpayer identification number, or
73	Medicaid or food stamp account number, or bank account or credit
74	card number;
75	2. Unique biometric data, such as fingerprint, voice
76	print, retina or iris image, or other unique physical
77	representation;
78	3. Unique electronic identification number, address, or
79	routing code; or
80	4. Telecommunication identifying information or access
81	device.
82	(2)(a) Any person who willfully and without authorization
83	fraudulently uses, or possesses with intent to fraudulently use,
84	personal identification information concerning an individual
85	without first obtaining that individual's consent, commits the
86	offense of fraudulent use of personal identification
87	information, which is a felony of the third degree, punishable
88	as provided in s. 775.082, s. 775.083, or s. 775.084.
89	(b) Any person who willfully and without authorization
90	fraudulently uses personal identification information concerning
91	an individual without first obtaining that individual's consent
92	commits a felony of the second degree, punishable as provided in
93	s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit,
94	the value of the services received, the payment sought to be
95	avoided, or the amount of the injury or fraud perpetrated is
96	$5,000$75,000 or more or if the person fraudulently uses the
97	personal identification information of 10 or more individuals
98	without their consent. Notwithstanding any other provision of
99	law, the court shall sentence any person convicted of committing
100	the offense described in this paragraph to a mandatory minimum
101	sentence of 3 years' imprisonment.
102	(c) Any person who willfully and without authorization
103	fraudulently uses personal identification information concerning
104	an individual without first obtaining that individual's consent
105	commits a felony of the first degree, punishable as provided in
106	s. 775.082, s. 775.083, or s. 775.084, if the pecuniary benefit,
107	the value of the services received, the payment sought to be
108	avoided, or the amount of the injury or fraud perpetrated is
109	$50,000 or more or if the person fraudulently uses the personal
110	identification information of 20 or more individuals without
111	their consent. Notwithstanding any other provision of law, the
112	court shall sentence any person convicted of committing the
113	offense described in this paragraph:
114	1. To a mandatory minimum sentence of 5 years'
115	imprisonment; or
116	2. If the pecuniary benefit, the value of the services
117	received, the payment sought to be avoided, or the amount of the
118	injury or fraud perpetrated is $100,000 or more or if the person
119	fraudulently uses the personal identification information of 30
120	or more individuals without their consent, to a mandatory
121	minimum sentence of 10 years' imprisonment.
122	(3) Nothing in paragraph (2)(b) or paragraph (2)(c) shall
123	prevent a court from imposing a greater sentence of
124	incarceration as authorized by law. If the minimum mandatory
125	terms of imprisonment imposed pursuant to paragraph(2)(b) or
126	paragraph (2)(c) exceed the maximum sentences authorized by s.
127	775.082, s. 775.084, or the Criminal Punishment Code under
128	chapter 921, the mandatory minimum sentence must be imposed. If
129	the mandatory minimum terms of imprisonment authorized by
130	paragraph (2)(b) or paragraph (2)(c) are less than the sentences
131	that could be imposed as authorized by s. 775.082, s. 775.084,
132	or the Criminal Punishment Code under chapter 921, the sentence
133	imposed by the court must include the mandatory minimum term of
134	imprisonment required by paragraph (2)(b) or paragraph (2)(c).
135	(4)(3)Any person who willfully and without authorization
136	possesses, uses, or attempts to use personal identification
137	information concerning an individual without first obtaining
138	that individual's consent, and who does so for the purpose of
139	harassing that individual, commits the offense of harassment by
140	use of personal identification information, which is a
141	misdemeanor of the first degree, punishable as provided in s.
142	775.082 or s. 775.083.
143	(5)(4)If an offense prohibited under this section was
144	facilitated or furthered by the use of a public record, as
145	defined in s. 119.011, the offense is reclassified to the next
146	higher degree as follows:
147	(a) A misdemeanor of the first degree is reclassified as a
148	felony of the third degree.
149	(b) A felony of the third degree is reclassified as a
150	felony of the second degree.
151	(c) A felony of the second degree is reclassified as a
152	felony of the first degree.
153
154	For purposes of sentencing under chapter 921 and incentive gain-
155	time eligibility under chapter 944, a felony offense that is
156	reclassified under this subsection is ranked one level above the
157	ranking under s. 921.0022 of the felony offense committed, and a
158	misdemeanor offense that is reclassified under this subsection
159	is ranked in level 2 of the offense severity ranking chart in s.
160	921.0022.
161	(6) Any person who willfully and without authorization
162	fraudulently uses personal identification information concerning
163	an individual less than 18 years of age without first obtaining
164	the consent of that individual or his or her legal guardian
165	commits a felony of the second degree, punishable as provided in
166	s. 775.082, s. 775.083, or s. 775.084.
167	(7) Any person in the relationship of parent or legal
168	guardian or who otherwise exercises custodial authority over an
169	individual less than 18 years of age, who willfully and
170	fraudulently uses personal identification information of that
171	individual, commits a felony of the second degree, punishable as
172	provided in s. 775.082, s. 775.083, or s. 775.084.
173	(8)(5)This section does not prohibit any lawfully
174	authorized investigative, protective, or intelligence activity
175	of a law enforcement agency of this state or any of its
176	political subdivisions, of any other state or its political
177	subdivisions, or of the Federal Government or its political
178	subdivisions.
179	(9)(6)(a) In sentencing a defendant convicted of an
180	offense under this section, the court may order that the
181	defendant make restitution pursuant to s. 775.089 to any victim
182	of the offense. In addition to the victim's out-of-pocket
183	costs, such restitution may include payment of any other costs,
184	including attorney's fees incurred by the victim in clearing the
185	victim's credit history or credit rating, or any costs incurred
186	in connection with any civil or administrative proceeding to
187	satisfy any debt, lien, or other obligation of the victim
188	arising as the result of the actions of the defendant.
189	(b) The sentencing court may issue such orders as are
190	necessary to correct any public record that contains false
191	information given in violation of this section.
192	(10)(7)Prosecutions for violations of this section may be
193	brought on behalf of the state by any state attorney or by the
194	statewide prosecutor.
195	(11)(8)The Legislature finds that, in the absence of
196	evidence to the contrary, the location where a victim gives or
197	fails to give consent to the use of personal identification
198	information is the county where the victim generally resides.
199	(12)(9)Notwithstanding any other provision of law, venue
200	for the prosecution and trial of violations of this section may
201	be commenced and maintained in any county in which an element of
202	the offense occurred, including the county where the victim
203	generally resides.
204	(13)(10)A prosecution of an offense prohibited under
205	subsection (2), subsection (6), or subsection (7)must be
206	commenced within 3 years after the offense occurred. However, a
207	prosecution may be commenced within 1 year after discovery of
208	the offense by an aggrieved party, or by a person who has a
209	legal duty to represent the aggrieved party and who is not a
210	party to the offense, if such prosecution is commenced within 5
211	years after the violation occurred.
212	Section 2. Subsection (1) of section 934.23, Florida
213	Statutes, is amended to read:
214	934.23 Required disclosure of customer communications or
215	records.--
216	(1) An investigative or law enforcement officer may
217	require the disclosure by a provider of electronic communication
218	service of the contents of a wire or electronic communication
219	that has been in electronic storage in an electronic
220	communications system for 180 days or less only pursuant to a
221	warrant issued by the judge of a court of competent
222	jurisdiction. For purposes of this section, "a court of
223	competent jurisdiction" means a court having jurisdiction over
224	the investigation or otherwise authorized by law.An
225	investigative or law enforcement officer may require the
226	disclosure by a provider of electronic communication services of
227	the contents of a wire or electronic communication that has been
228	in electronic storage in an electronic communications system for
229	more than 180 days by the means available under subsection (2).
230	Section 3. Section 92.605, Florida Statutes, is created to
231	read:
232	92.605 Production of certain records by Florida
233	corporations and out-of-state corporations.--
234	(1) For the purposes of this section, the term:
235	(a) "Adverse result" includes one of the following
236	consequences to notification of the existence of a court order,
237	a subpoena, or a search warrant:
238	1. Danger to the life or physical safety of an individual.
239	2. A flight from prosecution.
240	3. The destruction of or tampering with evidence.
241	4. The intimidation of potential witnesses.
242	5. Serious jeopardy to an investigation or undue delay of
243	a trial.
244	(b) "Applicant" means a law enforcement officer who is
245	seeking a court order or subpoena under s. 16.56, s. 27.04, s.
246	905.185, or s. 914.04 or who is issued a search warrant under s.
247	933.01, or anyone who is authorized to issue a subpoena under
248	the Florida Rules of Criminal Procedure.
249	(c) "Business" means any business, institution,
250	association, profession, occupation, or calling of any kind,
251	whether or not conducted for profit.
252	(d) "Electronic communication services" and "remote
253	computing services" have the same meaning as provided in the
254	Electronic Communications Privacy Act in chapter 121 (commencing
255	with s. 2701) of Part I of Title 18 of the United States Code
256	Annotated. This section does not apply to corporations that do
257	not provide those services to the public.
258	(e) "Out-of-state corporation" means any corporation that
259	is qualified to do business in this state under s. 607.1501.
260	(f) "Out-of-state record of regularly conducted business
261	activity" means a memorandum, report, record, or data
262	compilation, in any form, of acts, events, conditions, opinions,
263	or diagnoses maintained in another state or country.
264	(g) "Out-of-state certification" means a written
265	declaration made and signed in another state or country by the
266	custodian of an out-of-state record of regularly conducted
267	business activity or another qualified person that, if falsely
268	made, would subject the declarant to a criminal penalty under
269	the laws of another state or country.
270	(h) "Properly served" means delivery by hand or in a
271	manner reasonably allowing for proof of delivery if delivered by
272	United States mail, overnight-delivery service, or facsimile to
273	a person or entity properly registered to do business in any
274	state. In order for an out-of-state corporation to be properly
275	served, the service described in this paragraph must be effected
276	on the corporation’s registered agent.
277	(2) The following provisions apply to any subpoena, court
278	order, or search warrant issued in compliance with the
279	Electronic Communications Privacy Act in chapter 121 (commencing
280	with s. 2701) of Part I of Title 18 of the United States Code
281	Annotated, and that is subject to this chapter, which allows a
282	search for records that are in the actual or constructive
283	possession of an out-of-state corporation that provides
284	electronic communication services or remote computing services
285	to the public, when those records would reveal the identity of
286	the customers using those services; data stored by, or on behalf
287	of, the customers; the customers' usage of those services; the
288	recipients or destinations of communications sent to or from
289	those customers:
290	(a) Any subpoena, court order, or warrant issued pursuant
291	to this subsection shall contain the following language in bold
292	type on the first page of the document: “This [subpoena, order,
293	warrant] is issued pursuant to section 92.605, Florida Statutes.
294	A response is due within 20 business days after receipt of this
295	[subpoena, order, warrant], unless a longer time period is
296	stated herein.”
297	(b) When properly served with a subpoena, court order, or
298	search warrant issued by a Florida court or other applicant, an
299	out-of-state corporation subject to this section shall provide
300	to the applicant all records sought pursuant to such subpoena,
301	court order, or warrant within 20 business days after receipt,
302	or the date indicated within the subpoena, if later, including
303	those records maintained or located outside the State of
304	Florida. If the records cannot be produced within the 20-day
305	time period, the out-of-state corporation shall notify the
306	applicant within the 20-day time period and agree to produce the
307	documents at the earliest possible time. The applicant shall pay
308	the out-of-state corporation the reasonable expenses associated
309	with compliance.
310	(c) When the applicant makes a showing and the court finds
311	that failure to produce records within 20 business days would
312	cause an adverse result, the subpoena, court order, or warrant
313	may require production of records within less than 20 business
314	days. The correct deadline should be stated in bold text on the
315	first page of the document as required by paragraph (a). A court
316	may reasonably extend the time required for production of the
317	records upon finding that the out-of-state corporation needs the
318	extension and that an extension of time would not cause an
319	adverse result.
320	(d) An out-of-state corporation seeking to quash or object
321	to a subpoena, court order, or warrant must seek relief from the
322	court issuing such subpoena, court order, or warrant within the
323	time required for production of records under this section. The
324	issuing court shall hear and decide that motion within 5 court
325	days after the motion is filed.
326	(e) Upon written request from the applicant or if ordered
327	by the court, the out-of-state corporation shall verify the
328	authenticity of records that it produces by providing an
329	affidavit that complies with the requirements set forth in this
330	section. Records produced in compliance with this section are
331	admissible in evidence as set forth in subsection (5).
332	(3) A Florida business that provides electronic
333	communication services or remote computing services to the
334	public, when served with a subpoena, court order, or warrant
335	issued by another state to produce records that would reveal the
336	identity of the customers using those services; data stored by,
337	or on behalf of, the customers; the customers' usage of those
338	services; or the recipients or destinations of communications
339	sent to or from those customers shall produce those records as
340	if that subpoena, court order, or warrant had been issued by a
341	Florida court.
342	(4) A cause of action does not arise against any out-of-
343	state corporation or Florida business subject to this section,
344	or its officers, employees, agents, or other specified persons,
345	for providing records, information, facilities, or assistance in
346	accordance with the terms of a subpoena, court order, or warrant
347	subject to this section.
348	(5) In a criminal proceeding in a court of this state, an
349	out-of-state record of regularly conducted business activity, or
350	a copy of such record, shall not be excluded as hearsay evidence
351	by s. 90.802, if an out-of-state certification attests that:
352	(a) Such record was made at or near the time of the
353	occurrence of the matters set forth by, or from information
354	transmitted by, a person with knowledge of those matters.
355	(b) Such record was kept in the course of a regularly
356	conducted business activity.
357	(c) The business activity made such a record as a regular
358	practice.
359	(d) If such record is not the original, it is a duplicate
360	of the original, unless the source of information or the method
361	or circumstances of preparation indicate lack of
362	trustworthiness.
363	(6) An out-of-state certification under this section shall
364	authenticate such record or duplicate.
365	(7) No evidence in such records in the form of opinion or
366	diagnosis is admissible under subsection (5) unless such opinion
367	or diagnosis would be admissible under ss. 90.701-90.705 if the
368	person whose opinion is recorded were to testify to the opinion
369	directly.
370	(8) As soon after the arraignment as practicable, or 60
371	days prior to trial, a party intending to offer in evidence
372	under this section an out-of-state record of regularly conducted
373	business activity shall provide written notice of that intention
374	to each other party. A motion opposing admission in evidence of
375	such record shall be made by the opposing party and determined
376	by the court before trial. Failure by a party to file such
377	motion before trial shall constitute a waiver of objection to
378	such record or duplicate, but the court for cause shown may
379	grant relief from the waiver.
380	(9) In any criminal case, the content of any electronic
381	communication may be obtained under this section only by court
382	order or by the issuance of a search warrant, unless otherwise
383	provided under the Electronic Communications Privacy Act or
384	other provision of law.
385	Section 4. Paragraphs (e), (h), and (i) of subsection (3)
386	of section 921.0022, Florida Statutes, are amended to read:
387	921.0022 Criminal Punishment Code; offense severity
388	ranking chart.--
389	(3) OFFENSE SEVERITY RANKING CHART
390	FloridaStatute FelonyDegree Description
391	Section 5. This act shall take effect July 1, 2003.
392